On-Site Training Proposed Schedule
Introduction to Digital Forensics
Computer Forensics and Investigations
This section will introduce the participant to the field of computer forensics and how it can be used in criminal, civil and administrative matters.
This section covers:
This section reviews how data is stored on a typical Windows XP computer system. The basis file structure will be viewed in an actual forensic setting as the instructor demonstrates the forensic analysis the file structure of the previously created image.
Preparing a Computer Forensic Investigation
This section shows the investigator how to recognize, plan for and manage a computer investigation.
This section discusses and analyzes a computer system showing the investigator how to find deleted files, pictures, compressed files, and relevant documents. The investigator will be shown how to save and export the information in a report format.
Processing Crime and incident Scenes
This section guides the investigator through search and seizure scenarios. It includes corporate and law enforcement situations as well as overt vs. covert searches.
This section shows the investigators how to locate and analyze the Internet history found on a computer.
This section shows the investigator how to recognize and identify different e-mail systems found on today’s computers. The class will be shown how to extract and analyze that information.
Digital Evidence Controls
This section discusses how to handle digital evidence legally and properly. This topic is applicable to criminal, civil, and administrative cases. The objective for the investigator is legally and appropriately collecting all relevant digital data without harming or altering data that could cause the investigator to lose the case.
Forensic Tools and Software—Forensic labs
This section discusses the different tools available to today’s investigators. These range from free software to listservs and organizations willing to assist the computer forensic examiner with advice and help. The second half of the section will touch on equipment and lab settings.
Data Acquisition: Making Forensically Sound Images of Digital Media
This section covers a live demonstration showing the students how to make a forensic image of a common computer hard drive.
Reports and Courtroom Testimony
This section discusses the importance of writing a computer forensic report that is detailed yet understandable to judges, juries, attorneys, and the layperson. The topic will also discuss preparing for court testimony.